PERSONAL DATA PROTECTION POLICY FOR SUPPLIER OF KOBELCO CONSTRUCTION
MACHINERY SOUTHEAST ASIA CO., LTD.
1.Objectives of this policy
KOBELCO CONSTRUCTION MACHINERY SOUTHEAST ASIA CO., LTD. (hereinafter referred
to in this Policy as the “Company”) as the Personal Data Controller, committed to the protection of
personal data in the conduct of business appropriately and in accordance with "Personal Data
Protection Act B.E. 2562" (Personal Data Protection Act hereinafter referred to as PDPA or the Act)
therefore establishes this policy (which can also be referred to as privacy policy for the supplier of thecompany) in order to manage personal data of supplier and to notify supplier, who has status of“data subject”, about details related to the collection, use and disclosure of personal data inaccordance with rules and conditions stipulated by PDPA as follows:
2. Definition
2.1 “Personal data” means information about an individual which makes it possible to identify
that person either directly or indirectly but does not include data relating to juristic person and data ofa deceased person in particular according to PDPA
2.2 “Special category of personal data” or “Sensitive personal data” means data that canidentify an individual, either directly or indirectly, and is information as specified in Section 26 of the
PDPA including political cult religion or philosophy sexual behavior, criminal records, healthinformation, disability, Labour Union status, genetic data, biological data or any other data which
affects the data subject in a similar manner as prescribed by PDPA.

Page 1/21
Tasith (Assembly) Factory
WHA Eastern Seaboard Industrial Estate 1, 500/5 M. 3, T. Tasith, A. Pluakdaeng, Rayong 21140 Tel. +66 (0) 3895 0040-4 Fax +66 (0) 3895 0045-6

Pluakdaeng (Fabrication) Factory
Eastern Seaboard Industrial Estate 29 M. 4, T. Pluakdaeng, A. Pluakdaeng, Rayong 21140 Tel. +66 (0) 3895 4790-4 Fax +66 (0) 3895 4795

Bangkok Office4345 Bhiraj Tower at BITEC, Room 1503-1505, 15th Floor, Sukhumvit Road, Bangna Tai, Bangna, Bangkok 10260 Tel. +66 (0) 2399 5900-4 Fax +66 (0) 2399
5905

Philippines Branch
Unit 1501, 15th Floor, Wilcon IT HUB 2151 Chino Roces AVE., Bangkal, Makati City, Philippines 1233 Tel. +63 2 8820 7394 Fax +63 2 8816 1801

2.3 “Supplier or Vendor” (hereinafter referred to in this Policy as the “supplier”) means aperson or juristic person who has a legal relationship with the company under a juristic act or contract
including a contract of sale in which the supplier has the status of a seller, a service contract in which
the supplier has the status of a service provider, a transportation or logistic or contract of carriage inwhich the supplier has the status of carrier or agency or broker relating to such carriage or logistic,
etc. The supplier shall be considered as data subject of personal data in accordance with this policy
including employees or representatives or authorized representatives or agencies of supplier.
2.4 Personal data of supplier means personal data of suppliers who are natural person
including personal data of persons who are representatives or authorized representatives or agents
designated by supplier. This shall include personal data of employees, contractors, agents of the
supplier who are assigned or authorized by supplier to carry out contracts with the company.
2.5 Processing of personal data means the collection, use and disclosure of personal data.
2.6 “Personal Data controller” means a person or juristic person who has decision-making
powers to collect, use and disclose of personal data which, according to this policy, is KOBELCOCONSTRUCTION MACHINERY SOUTHEAST ASIA CO., LTD. and hereinafter shall be referred to as“the company”.
3. Scope of Policy and Fundamental Principles
3.1 Personal data in this policy includes personal data of the supplier which is in thepossession or control of the company regardless of the format or channel or technology the data is
saved or stored in, such as documented, printed, electronic or digital data, Information in the systemor program for the management of the company.
3.2 This policy does not cover the protection of corporate supplier' data or juristic person thatis not of a natural person, such as a company registration certificate, VAT registration certificate, abank account in the name of a juristic person
Page 2/21
Tasith (Assembly) Factory
WHA Eastern Seaboard Industrial Estate 1, 500/5 M. 3, T. Tasith, A. Pluakdaeng, Rayong 21140 Tel. +66 (0) 3895 0040-4 Fax +66 (0) 3895 0045-6

Pluakdaeng (Fabrication) Factory
Eastern Seaboard Industrial Estate 29 M. 4, T. Pluakdaeng, A. Pluakdaeng, Rayong 21140 Tel. +66 (0) 3895 4790-4 Fax +66 (0) 3895 4795

Bangkok Office4345 Bhiraj Tower at BITEC, Room 1503-1505, 15th Floor, Sukhumvit Road, Bangna Tai, Bangna, Bangkok 10260 Tel. +66 (0) 2399 5900-4 Fax +66 (0) 2399
5905

Philippines Branch
Unit 1501, 15th Floor, Wilcon IT HUB 2151 Chino Roces AVE., Bangkal, Makati City, Philippines 1233 Tel. +63 2 8820 7394 Fax +63 2 8816 1801

3.3 In processing personal data of supplier, the company will use lawful means as well as todo so under limited scope as necessary for the purposes specified in section 4 of this Policy.
4. Purpose of processing personal data of supplier.
The company processes personal data of supplier for the following purposes;
4.1 The company processes personal data of supplier for various operations and activities inrelation to the process of entering into a sale or service contract or other related contract such as
contract of carriage or logistic, between the company and supplier whereby the supplier make an offer
or an invitation to make an offer or request to contact or enter into a contract with the company either
by themselves or by supplier's employees, representatives, agencies. The processing of personal
data under this purpose includes but not limited to the following sub-purposes or activities;- For contract negotiation and requesting documents, information for making a decision toenter into a contract, such as sending and receiving proposals for price and service or product details-For carrying out the company's internal purchasing related processes and operations, suchas proceeding and obtaining approval of order to purchase products or receive service, approval ,supplier selection, price comparison process, examination the details of contracts to be entered intowith the supplier as well as the examination of relevant documents among related departments in thecompany.This shall include the processing of personal data of supplier within various departments ofthe company related to management procedures before and during entering into contracts with
supplier such as accounting, finance, purchasing, production, sales and marketing, etc.

Page 3/21
Tasith (Assembly) Factory
WHA Eastern Seaboard Industrial Estate 1, 500/5 M. 3, T. Tasith, A. Pluakdaeng, Rayong 21140 Tel. +66 (0) 3895 0040-4 Fax +66 (0) 3895 0045-6

Pluakdaeng (Fabrication) Factory
Eastern Seaboard Industrial Estate 29 M. 4, T. Pluakdaeng, A. Pluakdaeng, Rayong 21140 Tel. +66 (0) 3895 4790-4 Fax +66 (0) 3895 4795

Bangkok Office4345 Bhiraj Tower at BITEC, Room 1503-1505, 15th Floor, Sukhumvit Road, Bangna Tai, Bangna, Bangkok 10260 Tel. +66 (0) 2399 5900-4 Fax +66 (0) 2399
5905

Philippines Branch
Unit 1501, 15th Floor, Wilcon IT HUB 2151 Chino Roces AVE., Bangkal, Makati City, Philippines 1233 Tel. +63 2 8820 7394 Fax +63 2 8816 1801

4.2 The company processes personal data of supplier for the performance and execution ofcontracts between the company and the supplier including contract of sale or purchase or hire ofservice, or transportation and logistic, contract of carriage or agency or broker contract. This purpose
includes but not limited to the following sub-purposes or activities;-Processing of personal data of supplier to pay contractual debts, such as receiving anddelivering goods, inspection of goods, services, inspection of services, payment for goods orservices, inspection of documents related to the performance of contracts, execution of the trading
process, delivery of goods according to the contract of carriage or an agent contract of carriage,
document verification and examination relating to contract of carriage, including import and export
procedures. preparation of any documents related to the performance of the contract between thecompany and its supplier.
-Processing of personal data of supplier by various and different departments of the company
such as accounting, finance, purchasing, production, sales and marketing, etc. for internalmanagement and documentation processes that are necessary and related to the performance ofcontracts between the company and the supplier, such as registering the supplier’s personal data inthe system or “supplier or Vendor List”, processing commercial documents containing personal dataof supplier to the department or parties involved in order to perform the contract between thecompany and supplier.
-The processing of personal data of supplier by departments or among departments of thecompany in order to contact, notify about changes or movements related to the performance or
payment of debts under transactions or contracts between the company and the supplier by various
forms of documents both physical and electronic.

Page 4/21
Tasith (Assembly) Factory
WHA Eastern Seaboard Industrial Estate 1, 500/5 M. 3, T. Tasith, A. Pluakdaeng, Rayong 21140 Tel. +66 (0) 3895 0040-4 Fax +66 (0) 3895 0045-6

Pluakdaeng (Fabrication) Factory
Eastern Seaboard Industrial Estate 29 M. 4, T. Pluakdaeng, A. Pluakdaeng, Rayong 21140 Tel. +66 (0) 3895 4790-4 Fax +66 (0) 3895 4795

Bangkok Office4345 Bhiraj Tower at BITEC, Room 1503-1505, 15th Floor, Sukhumvit Road, Bangna Tai, Bangna, Bangkok 10260 Tel. +66 (0) 2399 5900-4 Fax +66 (0) 2399
5905

Philippines Branch
Unit 1501, 15th Floor, Wilcon IT HUB 2151 Chino Roces AVE., Bangkal, Makati City, Philippines 1233 Tel. +63 2 8820 7394 Fax +63 2 8816 1801

4.3 Processing of supplier's personal data to enable the company to perform various
obligations imposed by relevant laws including but not limited to transportation laws, carriage ofgoods laws, tax and custom laws, industrial and factory laws, computer crime law, personal dataprotection law, and to comply with regulation, announcement issued by competent authority under thelaws and for the purpose of making report, notification to government agencies or competent authority
according to laws and to comply with lawful order of competent official and court order.
4.4 Processing of supplier's personal data for the legitimate interests of the company which
includes but not limited to the following sub-purposes or activities;- Processing of the supplier's personal data in order to carry out administrative andmanagement for production, including calculating costs, production planning, determining technicaldetail and prices of product, profit and loss analysis, quality control and standard examination in
production.
-Processing of the supplier's personal data in order to carry out the company's financial andaccounting management processes, for example, using the name of supplier contained in contract orcommercial documents between the company and supplier, using personal data of supplier in the
disbursement process within the company, internal audit and the preparation of various company
reports related to such documents.
- Processing of the supplier's personal data for internal management of the company, apartform financial and production, such as the process of documents in compliance with industrial andmanagerial standard such as International standard Organization (ISO)-Processing of the supplier's personal data for internal management of the company in supportof the performance of contracts between the company and the supplier including the processing of
personal data of supplier by several departments within the company in order to making reference,contacting or coordinating with supplier.
Page 5/21
Tasith (Assembly) Factory
WHA Eastern Seaboard Industrial Estate 1, 500/5 M. 3, T. Tasith, A. Pluakdaeng, Rayong 21140 Tel. +66 (0) 3895 0040-4 Fax +66 (0) 3895 0045-6

Pluakdaeng (Fabrication) Factory
Eastern Seaboard Industrial Estate 29 M. 4, T. Pluakdaeng, A. Pluakdaeng, Rayong 21140 Tel. +66 (0) 3895 4790-4 Fax +66 (0) 3895 4795

Bangkok Office4345 Bhiraj Tower at BITEC, Room 1503-1505, 15th Floor, Sukhumvit Road, Bangna Tai, Bangna, Bangkok 10260 Tel. +66 (0) 2399 5900-4 Fax +66 (0) 2399
5905

Philippines Branch
Unit 1501, 15th Floor, Wilcon IT HUB 2151 Chino Roces AVE., Bangkal, Makati City, Philippines 1233 Tel. +63 2 8820 7394 Fax +63 2 8816 1801

-Processing of the supplier's personal data for the preparation of periodic reports such as
weekly, monthly, yearly report as part of the company's internal management.
- Processing of supplier’s personal data for internal and external audit or inspection inconnection with financial and accounting, investigating and preventing fraud, misconduct or illegal
activities or for preparation of legal proceeding or litigation.
- Processing of supplier's personal data for purposes of environmental management and of thecompany including processing data for auditing environmental standards.
- Processing of supplier's personal data in case of entering to the company's area or property
for business dealings, visits, coordination, etc., whereby the company processes the supplier's
personal data for security reason.
4.5 To prevent and suppress danger to life, body or health of supplier or other person, such asprocessing personal data for emergency contact, for activities relating to the control and prevention of
infectious diseases.
4.6 For marketing, public relation, sending news, organizing relationship activities orcooperation projects or coordination between the company and supplier.
4.7 For the purpose of checking and evaluating the service or product standards of the
supplier both during the period before, during and after the service or sale of goods by auditing andassessing standards which covers both the criteria that the company must comply with by laws and/or
the criteria that the company must comply with internal audits or other standards related to theprovision of services or goods of supplier.

Page 6/21
Tasith (Assembly) Factory
WHA Eastern Seaboard Industrial Estate 1, 500/5 M. 3, T. Tasith, A. Pluakdaeng, Rayong 21140 Tel. +66 (0) 3895 0040-4 Fax +66 (0) 3895 0045-6

Pluakdaeng (Fabrication) Factory
Eastern Seaboard Industrial Estate 29 M. 4, T. Pluakdaeng, A. Pluakdaeng, Rayong 21140 Tel. +66 (0) 3895 4790-4 Fax +66 (0) 3895 4795

Bangkok Office4345 Bhiraj Tower at BITEC, Room 1503-1505, 15th Floor, Sukhumvit Road, Bangna Tai, Bangna, Bangkok 10260 Tel. +66 (0) 2399 5900-4 Fax +66 (0) 2399
5905

Philippines Branch
Unit 1501, 15th Floor, Wilcon IT HUB 2151 Chino Roces AVE., Bangkal, Makati City, Philippines 1233 Tel. +63 2 8820 7394 Fax +63 2 8816 1801

4.8 For supplier or vendor assessment or evaluation, including assessment of contract
performance , assessment of suppliers' services or products according to criteria or indicators
established by the company or according to criteria or indicators that the company is obliged tocomply in accordance with internal or relevant audit, in order for the company to use such assessment
or evaluation results for management, planning, cost analysis, for decision making process to select orenter into a new contract with supplier, including for the improvement of the production process or theindustrial operation of the company that is not directly related to the fulfillment of the obligations ofsupplier under related contract such as purchase contract, service contract or any other contracts
that exist between supplier and the company.
4.9 For purposes other than notified in section 4.1-4.8, the company shall notify to supplier asa data subject on a case-by-case basis.
The company shall not process your personal data which is inconsistent to the purposes forwhich the data is collected as notified in this policy unless (1) The company has notified the new
purpose and obtained your consent prior to or at the time of processing. (2) It is a case prescribed bylaw.
Regarding the process of personal data of our supplier for the aforementioned purposes, thecompany shall proceed according to the conditions or legal grounds set forth in section 5 of this policy.
5. Legal basis for processing personal data of supplier.
5.1 In principle, the company processes personal data of supplier on basis of consent bymeans required by PDPA, except where the law stipulates condition that can be processed withoutobtaining the consent of data subject, such as the performance of a contract, legal obligation,
legitimate interests of the data controller, the protection of life, health or safety of other data subject,
the investigating by competent authority or court order.
Page 7/21
Tasith (Assembly) Factory
WHA Eastern Seaboard Industrial Estate 1, 500/5 M. 3, T. Tasith, A. Pluakdaeng, Rayong 21140 Tel. +66 (0) 3895 0040-4 Fax +66 (0) 3895 0045-6

Pluakdaeng (Fabrication) Factory
Eastern Seaboard Industrial Estate 29 M. 4, T. Pluakdaeng, A. Pluakdaeng, Rayong 21140 Tel. +66 (0) 3895 4790-4 Fax +66 (0) 3895 4795

Bangkok Office4345 Bhiraj Tower at BITEC, Room 1503-1505, 15th Floor, Sukhumvit Road, Bangna Tai, Bangna, Bangkok 10260 Tel. +66 (0) 2399 5900-4 Fax +66 (0) 2399
5905

Philippines Branch
Unit 1501, 15th Floor, Wilcon IT HUB 2151 Chino Roces AVE., Bangkal, Makati City, Philippines 1233 Tel. +63 2 8820 7394 Fax +63 2 8816 1801

5.2 The company shall process personal data of supplier in accordance with purposes notified
in section 4.1-4.5 without your consent, subject to the conditions and circumstances required by
PDPA. In case the processing of personal data under the aforementioned purposes, requires thecompany to disclose or transfer supplier's personal data outside the Kingdom of Thailand thecompany shall proceed without consent under conditions set forth by PDPA.
5.3 The company shall process personal data of supplier for the purpose notified in section
4.6-4.8 by obtaining consent in the form attached to this policy.
5.4 The company shall process personal data of supplier for the purpose notified in section 4.9
by obtaining consent on a case-by-case basis
5.5 In case that the company processes personal data of supplier under consent basis
according to the form attached to this policy, you have the right to withdraw consent at any time under
the conditions of PDPA. However, withdrawing consent shall not affect the collection, use, disclosureof personal data that the company have already processed prior to such withdrawal but this may resultin the company being unable to perform some or all of the objectives as stated in this Policy.
6. Collection of personal data directly from data subject.
6.1 The company shall not collect personal data from sources other than the data subject
except in cases where it can be done as provided by law. In case that the company collects personal
data from a person other than data subject, the company shall notify the data subject of its collection
from other sources and obtain consent except in case provided by law
6.2 In case the processing of personal data under purposes notified in section 4.1 and/or 4.2
involved personal data of employee or contractor or agent of the supplier or designated or assigned
person of supplier which were transferred or submitted to the company by the supplier, or such data
appears in documents relating to transactions under the purposes in section 4.1 and/or 4.2, The
supplier, as their personal data controller, shall undertakes and ensures to process and disclose such
Page 8/21
Tasith (Assembly) Factory
WHA Eastern Seaboard Industrial Estate 1, 500/5 M. 3, T. Tasith, A. Pluakdaeng, Rayong 21140 Tel. +66 (0) 3895 0040-4 Fax +66 (0) 3895 0045-6

Pluakdaeng (Fabrication) Factory
Eastern Seaboard Industrial Estate 29 M. 4, T. Pluakdaeng, A. Pluakdaeng, Rayong 21140 Tel. +66 (0) 3895 4790-4 Fax +66 (0) 3895 4795

Bangkok Office4345 Bhiraj Tower at BITEC, Room 1503-1505, 15th Floor, Sukhumvit Road, Bangna Tai, Bangna, Bangkok 10260 Tel. +66 (0) 2399 5900-4 Fax +66 (0) 2399
5905

Philippines Branch
Unit 1501, 15th Floor, Wilcon IT HUB 2151 Chino Roces AVE., Bangkal, Makati City, Philippines 1233 Tel. +63 2 8820 7394 Fax +63 2 8816 1801

personal data with the consent of the data subject, and such consent shall cover the processing ofsuch data for entering into contracts or performing contracts between the supplier and the company
unless there are other legal grounds to process such personal data without consent. In the case ofprocessing such data based on consent, the supplier shall provide documentary evidence that theconsent of such person has been obtained and the company may request the supplier to present
such evidence in order to confirm the compliance with lawful basis of processing personal data.
In addition, If the company as data controller in our part is unable to notify the details under
this policy to such person and/or obtain their consent in accordance with the form attached to thispolicy, the supplier agrees to bring this policy to notify to and/or obtain consent the from such person
on behalf of the company and the company may request the supplier to present such evidence of
notification and/or consent.
6.3 In case the processing of personal data under purposes notified in section 4.3-4.5 involved
personal data of employee or contractor or agent of the supplier or designated or assigned person of
supplier which were transferred or submitted to the company by the supplier, or such data appears in
documents relating to transactions under such purposes which the company shall process such data
without consent according to PDPA, The company may reserve the right to request the supplier, who
is an employer or principal of such persons, to present evidence demonstrating lawful basis inprocessing personal data of such person. In addition, If the company as data controller in our part isunable to notify the details under this policy to such person, the supplier agrees to bring this policy tonotify to such person on behalf of the company and the company may request the supplier to present
such evidence of notification.

Page 9/21
Tasith (Assembly) Factory
WHA Eastern Seaboard Industrial Estate 1, 500/5 M. 3, T. Tasith, A. Pluakdaeng, Rayong 21140 Tel. +66 (0) 3895 0040-4 Fax +66 (0) 3895 0045-6

Pluakdaeng (Fabrication) Factory
Eastern Seaboard Industrial Estate 29 M. 4, T. Pluakdaeng, A. Pluakdaeng, Rayong 21140 Tel. +66 (0) 3895 4790-4 Fax +66 (0) 3895 4795

Bangkok Office4345 Bhiraj Tower at BITEC, Room 1503-1505, 15th Floor, Sukhumvit Road, Bangna Tai, Bangna, Bangkok 10260 Tel. +66 (0) 2399 5900-4 Fax +66 (0) 2399
5905

Philippines Branch
Unit 1501, 15th Floor, Wilcon IT HUB 2151 Chino Roces AVE., Bangkal, Makati City, Philippines 1233 Tel. +63 2 8820 7394 Fax +63 2 8816 1801

6.4 In case the processing of personal data under purposes notified in section 4.1 and/or 4.2
involved sensitive personal data of employee or contractor or agent of the supplier or designated orassigned person of supplier which were transferred or submitted to the company by the supplier, The
supplier as their personal data controller, shall undertakes and ensures to process and disclose such
personal data with the consent of the data subject, and such consent shall cover the processing ofsuch data for entering into contracts or performing contracts between the supplier and the company
unless there are other legal grounds to process such personal data without consent.
However, If the company as data controller in our part is unable to notify the details under thispolicy to such person and/or obtain their consent in accordance with the form attached to this policy,
the supplier agrees to bring this policy to notify to and/or obtain consent the from such person on
behalf of the company (with the consent form attached to this policy; part 2 consent for processing
personal data of employee, agency, representative of supplier) and the company may request the
supplier to present such evidence of notification and/or consent.
6.5 In case the processing of personal data under purposes notified in section 4.3 and/or 4.5
involved personal data of employee or contractor or agent of the supplier or designated or assigned
person of supplier, If the company as data controller in our part is unable to notify the details under
this policy to such person, the supplier agrees to bring this policy to notify to such person on behalf ofthe company and the supplier shall be requested to present such evidence in order to confirm thecompliance with lawful basis of processing personal data
6.6 In case the processing of personal data under purposes notified in section 4.4 involved
personal data of employee or contractor or agent of the supplier or designated or assigned person of
supplier, If the company as data controller in our part is unable to notify the details under this policy tosuch person and/or obtain their consent in accordance with the form attached to this policy, thesupplier agrees to bring this policy to notify to and/or obtain consent the from such person on behalf ofPage 10/21
Tasith (Assembly) Factory
WHA Eastern Seaboard Industrial Estate 1, 500/5 M. 3, T. Tasith, A. Pluakdaeng, Rayong 21140 Tel. +66 (0) 3895 0040-4 Fax +66 (0) 3895 0045-6

Pluakdaeng (Fabrication) Factory
Eastern Seaboard Industrial Estate 29 M. 4, T. Pluakdaeng, A. Pluakdaeng, Rayong 21140 Tel. +66 (0) 3895 4790-4 Fax +66 (0) 3895 4795

Bangkok Office4345 Bhiraj Tower at BITEC, Room 1503-1505, 15th Floor, Sukhumvit Road, Bangna Tai, Bangna, Bangkok 10260 Tel. +66 (0) 2399 5900-4 Fax +66 (0) 2399
5905

Philippines Branch
Unit 1501, 15th Floor, Wilcon IT HUB 2151 Chino Roces AVE., Bangkal, Makati City, Philippines 1233 Tel. +63 2 8820 7394 Fax +63 2 8816 1801

the company. (with the consent form attached to this policy; part 2 consent for processing personal
data of employee, agency, representative of supplier) and the supplier shall be requested to present
such evidence to the company in order to confirm the compliance with lawful basis of processing
personal data
7. Personal data of supplier processed by the company and the retention period.
7.1 The company shall process and retain the supplier's personal data for the period
necessary to achieve the purpose of processing as notified in this policy unless the law requires for alonger retention period. In case the retention period of personal data cannot be clearly specified, thecompany shall retain the data for a period of time that could be expected in accordance with thestandards of collection.
7.2 The company shall collect, use and disclose of personal data of supplier including its
employees, contractors, representatives, assigned or designated person, for the purposes of section
4.1 and/or 4.2 as follows;-Name, surname, job title, telephone number, electronic mail address, business card
- Information used to verify identity, Identity-card information, passport- Financial information such as bank account numbers, copy of bank passbook-Profile of juristic person (Corporate profile) which includes identified data of natural personsuch as name, image.
- Conversation information on various communication channels in the process of entering into
a contract and performing the contract including contact information and electronic communications.
In case the company processes supplier’s personal data in accordance with the purposes
notified in section 4.1 and 4.2, such data shall be retained for a period throughout the term of therelevant contracts and also retained after the expiration of the said contract for a period of time
specified by law for the exercise of claims, litigation related to the contract
Page 11/21
Tasith (Assembly) Factory
WHA Eastern Seaboard Industrial Estate 1, 500/5 M. 3, T. Tasith, A. Pluakdaeng, Rayong 21140 Tel. +66 (0) 3895 0040-4 Fax +66 (0) 3895 0045-6

Pluakdaeng (Fabrication) Factory
Eastern Seaboard Industrial Estate 29 M. 4, T. Pluakdaeng, A. Pluakdaeng, Rayong 21140 Tel. +66 (0) 3895 4790-4 Fax +66 (0) 3895 4795

Bangkok Office4345 Bhiraj Tower at BITEC, Room 1503-1505, 15th Floor, Sukhumvit Road, Bangna Tai, Bangna, Bangkok 10260 Tel. +66 (0) 2399 5900-4 Fax +66 (0) 2399
5905

Philippines Branch
Unit 1501, 15th Floor, Wilcon IT HUB 2151 Chino Roces AVE., Bangkal, Makati City, Philippines 1233 Tel. +63 2 8820 7394 Fax +63 2 8816 1801

7.3 The company processes personal data of supplier, including those of his or her employee,
contractor, representative, designated or assigned person, for the purposes notified in section 4.3
which consists of first name, last name, identification number, phone number, passport, contact
information and shall be retained for the period required by law.
7.4 The company processes personal data of supplier, including those of his or her employee,
contractor, representative, designated or assigned person, for the purposes notified in section 4.4 asfollows:-In processing personal data for purposes of production process management, quality control,
administrative and management within the company, quality control, assurance of standard or
systems, internal audit, financial and accounting audits, etc., personal data of supplier consists of first
name, last name, ID card number. telephone numbers, contact information, financial ortransaction information related to the company which shall be retained for a period of not more than 2
years or according to the period specified by law for the exercise of claims, litigation, related matters.
-In the case of personal data collected by Closed-Circuit Television Video (CCTV), including
photographs, video and/or audio, the company shall retain the following information: (1) Under normal
circumstances, supplier's personal data is retained for 30 days (2) In cases where it is required as
evidence in an investigation or prosecution, or in the case of requested by data subject, personal data
may be retained more than 30 days, for the period necessary to pursue the relevant prosecution or
litigation.

Page 12/21
Tasith (Assembly) Factory
WHA Eastern Seaboard Industrial Estate 1, 500/5 M. 3, T. Tasith, A. Pluakdaeng, Rayong 21140 Tel. +66 (0) 3895 0040-4 Fax +66 (0) 3895 0045-6

Pluakdaeng (Fabrication) Factory
Eastern Seaboard Industrial Estate 29 M. 4, T. Pluakdaeng, A. Pluakdaeng, Rayong 21140 Tel. +66 (0) 3895 4790-4 Fax +66 (0) 3895 4795

Bangkok Office4345 Bhiraj Tower at BITEC, Room 1503-1505, 15th Floor, Sukhumvit Road, Bangna Tai, Bangna, Bangkok 10260 Tel. +66 (0) 2399 5900-4 Fax +66 (0) 2399
5905

Philippines Branch
Unit 1501, 15th Floor, Wilcon IT HUB 2151 Chino Roces AVE., Bangkal, Makati City, Philippines 1233 Tel. +63 2 8820 7394 Fax +63 2 8816 1801

-In case of personal data collected electronically for information security purposes, personal
data collected includes; Electronic mail address, Information on the use of the company's website andcomputer system, computer traffic data, data from usage logs, device identifier, computer's IP
address, device ID, data connection information, such data shall be retained for the period specified
by law, such as the collection required by the Computer Crime Act, including the retention for theperiod necessary for relevant litigation.
-In case of processing of personal data of supplier for purposes in section 4.4 other than those
notified above, the personal data collected consists of first name, last name, ID card number, phone
number, contact information, which shall be retained for a period not exceeding 1 year or for theperiod specified by laws for the exercise of claims, litigation, and related matters.
7.5 The company processes supplier’s personal data, including those of his or her employees,
contractors, representatives, assigned or designated persons for the purposes of section 4.5 which
consists of name, surname, ID card number, phone numbers, contact information, photographs, etc.
Such data shall be retained for a period not exceeding 1 year or for the period specified by laws forthe exercise of claim, litigation, and related matters.
7.6 The company processes supplier’s personal data, including those of his or her employee,
contractor, representatives, assigned or designated persons, for the purposes notified in section 4.64.9, including first name, last name, telephone number, contact information, etc. which the company
shall retain for a period not exceeding 1 year or until the data subject requests to withdraw consent
and the company completely proceed on that request but the company shall continue to retain such
personal data to the extent necessary for making record or evidence and for responding to future
requests of data subjects. In addition, the company may retain personal data for such purposes for aperiod of time required by law for the exercise of claim, litigation, and related matters.
Page 13/21
Tasith (Assembly) Factory
WHA Eastern Seaboard Industrial Estate 1, 500/5 M. 3, T. Tasith, A. Pluakdaeng, Rayong 21140 Tel. +66 (0) 3895 0040-4 Fax +66 (0) 3895 0045-6

Pluakdaeng (Fabrication) Factory
Eastern Seaboard Industrial Estate 29 M. 4, T. Pluakdaeng, A. Pluakdaeng, Rayong 21140 Tel. +66 (0) 3895 4790-4 Fax +66 (0) 3895 4795

Bangkok Office4345 Bhiraj Tower at BITEC, Room 1503-1505, 15th Floor, Sukhumvit Road, Bangna Tai, Bangna, Bangkok 10260 Tel. +66 (0) 2399 5900-4 Fax +66 (0) 2399
5905

Philippines Branch
Unit 1501, 15th Floor, Wilcon IT HUB 2151 Chino Roces AVE., Bangkal, Makati City, Philippines 1233 Tel. +63 2 8820 7394 Fax +63 2 8816 1801

7.7 The company shall provide an audit system for deletion or destruction of personal data
after the expiration of the retention period or which is irrelevant to or unnecessary for the purposes ofprocessing notified by this policy
8. Disclosure or transfer of personal data of supplier to other persons or juristic persons.
8.1 The company shall disclose or transfer or transmit personal data of supplier to other parties
or entities for the purposes notified in section 4 without your consent as provided by PDPA. This may
include but not limited to the following purposes;- In carrying out the purposes notified in section 4.1 and/or 4.2, the company shall be required
to disclose or transmit or transfer supplier’s personal data to a supervisory or regulating government
agency such as tax or custom department.
- In carrying out the purposes notified in section 4.1 and/or 4.2, the company shall be required
to disclose or transmit or transfer supplier’s personal data to financial service provider, electronictransaction provider such as bank, technology or information system provider, cloud storage service,
application or software service provider.
-In carrying out the purposes notified in section 4.1 and/or 4.2, the company shall be required
to disclose or transmit or transfer supplier’s personal data to another supplier or relevant service
providers, such as transport and logistics service providers, freight forwarder, carrier of goods,
custom broker, insurance company.
8.2 In case of any actions or transactions related to entering into a contract negotiating before
or after the performance of contracts between the company and the supplier pursuant to the purposesof section 4.1 and/or section 4.2 and the supplier has sent or transferred personal data of employee orcontractor or agent of the supplier or designated or assigned person of supplier which are insupplier's possession or control, the company shall disclose such transferred data to competent
Page 14/21
Tasith (Assembly) Factory
WHA Eastern Seaboard Industrial Estate 1, 500/5 M. 3, T. Tasith, A. Pluakdaeng, Rayong 21140 Tel. +66 (0) 3895 0040-4 Fax +66 (0) 3895 0045-6

Pluakdaeng (Fabrication) Factory
Eastern Seaboard Industrial Estate 29 M. 4, T. Pluakdaeng, A. Pluakdaeng, Rayong 21140 Tel. +66 (0) 3895 4790-4 Fax +66 (0) 3895 4795

Bangkok Office4345 Bhiraj Tower at BITEC, Room 1503-1505, 15th Floor, Sukhumvit Road, Bangna Tai, Bangna, Bangkok 10260 Tel. +66 (0) 2399 5900-4 Fax +66 (0) 2399
5905

Philippines Branch
Unit 1501, 15th Floor, Wilcon IT HUB 2151 Chino Roces AVE., Bangkal, Makati City, Philippines 1233 Tel. +63 2 8820 7394 Fax +63 2 8816 1801

authorities in connection to such purposes, and shall also process including disclosure of the personal
data for purposes notified in section 4.3-4.5 without consent of such data subject. However, If thecompany as data controller in our part is unable to notify this policy to aforementioned data subject inaccordance with the form attached to this policy, the supplier agrees to bring this policy to notify such
person on behalf of the company.
8.3 In case of personal data of an employee or contractor or agent of the supplier ordesignated or assigned person of supplier which the supplier has sent or transferred to the company
for the purposes of the contract in accordance with purposes notified in section 4.1 and/or 4.2, thecompany may disclose or transfer or transmit such information to another person for the performanceof contracts between the company and supplier who are their employer or principal which shall bebased on legitimate interests of the company without consent unless it is required by PDPA to process
such data based on consent from data subject such as in case of special type or sensitive personal
data contained in documents. However, If the company as data controller in our part is unable tonotify the details under this policy to such person and/or obtain their consent in accordance with theform attached to this policy, the supplier agrees to bring this policy to notify to and/or obtain consent
the from such person on behalf of the company. (with the consent form attached to this policy; part 2
consent for processing personal data of employee, agency, representative of supplier)
8.4 The company shall disclose or transfer or transmit the supplier's personal data to anothersupplier or third parties based on legitimate interest of the company as notified in section 4.4 without
the consent of the supplier under the condition of PDPA, including but not limited to the following
activities;

Page 15/21
Tasith (Assembly) Factory
WHA Eastern Seaboard Industrial Estate 1, 500/5 M. 3, T. Tasith, A. Pluakdaeng, Rayong 21140 Tel. +66 (0) 3895 0040-4 Fax +66 (0) 3895 0045-6

Pluakdaeng (Fabrication) Factory
Eastern Seaboard Industrial Estate 29 M. 4, T. Pluakdaeng, A. Pluakdaeng, Rayong 21140 Tel. +66 (0) 3895 4790-4 Fax +66 (0) 3895 4795

Bangkok Office4345 Bhiraj Tower at BITEC, Room 1503-1505, 15th Floor, Sukhumvit Road, Bangna Tai, Bangna, Bangkok 10260 Tel. +66 (0) 2399 5900-4 Fax +66 (0) 2399
5905

Philippines Branch
Unit 1501, 15th Floor, Wilcon IT HUB 2151 Chino Roces AVE., Bangkal, Makati City, Philippines 1233 Tel. +63 2 8820 7394 Fax +63 2 8816 1801

-Disclosing or transferring or transmitting supplier personal data to internal or external auditor,
competent authority and government, for the purpose of quality control, assurance and assessment ofindustrial related standards assurance.
-Disclosing or transferring or transmitting supplier personal data to private auditor orgovernment official in order to proceed with inspection or audition relating to finance, accounting or
law and regulation compliance auditing.
-Disclosing or transferring or transmitting supplier personal data to organizations and agencies
related to investment promotion for the purpose of applying and receiving industrial and commercial
benefits of the company-Disclosing or transferring or transmitting supplier personal data to supplier of the company
that provides physical and/or electronic security services
8.5 The company shall obtain consent of the supplier for the disclosure or transfer ortransmission of the supplier's personal data for other purposes which the consent is required by PDPA
8.6 In case the recipient of personal data from the aforementioned disclosure or transmission
or transfer has the status of a personal data processor, the company shall proceed with the
preparation of data processing contract as required by PDPA.
8.7 The company may transmit or transfer or disclose the supplier's personal data to otherpersons or entities outside the Kingdom of Thailand pursuant to purposes notified in section 4.1 or 4.2
or 4.3, including but not limited to in case of need for performing obligations under the contract towhich the supplier is the contracting party, or for performing obligations under a contract between thecompany and another person or entity for the benefit of the supplier, or for the purpose of fulfilling the
supplier's request prior to entering into a contract or to comply with the law, without consent fromPage 16/21
Tasith (Assembly) Factory
WHA Eastern Seaboard Industrial Estate 1, 500/5 M. 3, T. Tasith, A. Pluakdaeng, Rayong 21140 Tel. +66 (0) 3895 0040-4 Fax +66 (0) 3895 0045-6

Pluakdaeng (Fabrication) Factory
Eastern Seaboard Industrial Estate 29 M. 4, T. Pluakdaeng, A. Pluakdaeng, Rayong 21140 Tel. +66 (0) 3895 4790-4 Fax +66 (0) 3895 4795

Bangkok Office4345 Bhiraj Tower at BITEC, Room 1503-1505, 15th Floor, Sukhumvit Road, Bangna Tai, Bangna, Bangkok 10260 Tel. +66 (0) 2399 5900-4 Fax +66 (0) 2399
5905

Philippines Branch
Unit 1501, 15th Floor, Wilcon IT HUB 2151 Chino Roces AVE., Bangkal, Makati City, Philippines 1233 Tel. +63 2 8820 7394 Fax +63 2 8816 1801

data subject, in accordance with the conditions set forth in PDPA. However, in case that the company
transfers personal data of a supplier outside the Kingdom of Thailand for the purposes of legitimate
interests in accordance with section 4.4, the company will obtain consent from the data subject inaccordance with a form attached to this policy.
.

9. Security of personal data
9.1 The company shall provide appropriate security measures for personal data of our supplier
to prevent the loss, access, use, alteration, alteration or disclosure of personal data withoutauthorization and shall periodically review such measures or update the measures when technology
changes in order to maintain level of appropriate measures, this shall be in accordance with theminimum standards announced by the Committee under PDPA.
9.2 The company shall provide appropriate security measures in accordance with thestandard of the Ministry of Digital Economy and Society Regulations and other related subordinate
laws by establishing administrative measure, technical measure, physical measure which cover thefollowing measures:(1) Controlling access to personal data, data storage, data processing equipment by taking
into account the practical in use and the protection of security.
(2) Determination of permission or assignment of right to access personal data.
(3) User access management to control access to personal data for authorized persons.
(4) Determination of user responsibilities to prevent unauthorized access, disclosure, theft ofpersonal data, theft of storage or processing devices.

Page 17/21
Tasith (Assembly) Factory
WHA Eastern Seaboard Industrial Estate 1, 500/5 M. 3, T. Tasith, A. Pluakdaeng, Rayong 21140 Tel. +66 (0) 3895 0040-4 Fax +66 (0) 3895 0045-6

Pluakdaeng (Fabrication) Factory
Eastern Seaboard Industrial Estate 29 M. 4, T. Pluakdaeng, A. Pluakdaeng, Rayong 21140 Tel. +66 (0) 3895 4790-4 Fax +66 (0) 3895 4795

Bangkok Office4345 Bhiraj Tower at BITEC, Room 1503-1505, 15th Floor, Sukhumvit Road, Bangna Tai, Bangna, Bangkok 10260 Tel. +66 (0) 2399 5900-4 Fax +66 (0) 2399
5905

Philippines Branch
Unit 1501, 15th Floor, Wilcon IT HUB 2151 Chino Roces AVE., Bangkal, Makati City, Philippines 1233 Tel. +63 2 8820 7394 Fax +63 2 8816 1801

(5) Providing a means to check a traceability of access, change, deletion or transfer of
personal data in consistent with the methods and mediums used for collecting, using or disclosing
personal data.
The detail of security measures of personal data shall also be in accordance with conditions
set out in relevant policies and/or regulations such as the “IT Policy”.
9.3 Employee, personal data processor or other persons assigned by the company shallmanage personal data of supplier carefully within the scope of its intended use and in accordancewith the security standards applicable to this Policy. The company has also arranged an agreement orcontract with such person to instruct and determine the duty to maintain the security of personal data.
9.4 In processing personal data of supplier in accordance with the purposes notified in section
4, the company may have other entities acting as data processor to collect, use and disclose personal
data on behalf of or on the company's order, such processors shall be obliged to provide appropriate
security measures, which shall include the measures in section 9.2, in accordance with details andinstructions specified by the company in Personal Data Processing Agreement.
10 Rights of data subject
The supplier under the definition of this policy shall be entitled to data subject’s rights as
stipulated by PDPA as follows:
10.1 Data subject has the right to know about his or her personal data by making a request to
the company in accordance with the condition, criteria, method and a form provided by the company.
Upon receiving such request, the company shall promptly notify the existence of or detail of such
personal data to data subject within a reasonable period of time and in accordance with the conditionprescribed by PDPA.

Page 18/21
Tasith (Assembly) Factory
WHA Eastern Seaboard Industrial Estate 1, 500/5 M. 3, T. Tasith, A. Pluakdaeng, Rayong 21140 Tel. +66 (0) 3895 0040-4 Fax +66 (0) 3895 0045-6

Pluakdaeng (Fabrication) Factory
Eastern Seaboard Industrial Estate 29 M. 4, T. Pluakdaeng, A. Pluakdaeng, Rayong 21140 Tel. +66 (0) 3895 4790-4 Fax +66 (0) 3895 4795

Bangkok Office4345 Bhiraj Tower at BITEC, Room 1503-1505, 15th Floor, Sukhumvit Road, Bangna Tai, Bangna, Bangkok 10260 Tel. +66 (0) 2399 5900-4 Fax +66 (0) 2399
5905

Philippines Branch
Unit 1501, 15th Floor, Wilcon IT HUB 2151 Chino Roces AVE., Bangkal, Makati City, Philippines 1233 Tel. +63 2 8820 7394 Fax +63 2 8816 1801

10.2 If the data subject is of an opinion that any personal data relating to him or her is notcorrect, data subject has the right to notify the company to correct, change or update the data. In thiscase, the company shall prepare a record demonstrating details of request, response, or objection ofrequest relating to the storage, correctness or any action relating to personal data as evidence.
10.3 Data subject has the right to check the existence and characteristics of his or her
personal data, purpose of processing and the place of business of the company. In addition, data
subject shall be entitled to several rights as follows;
1) Requesting a copy or certified copy of the data subject's personal data.
2) Requesting the company to correct, change or update his or her personal data.
3) Requesting an objection or request to suspend the use or disclose his or her personal data.
4) Requesting the company to delete or destroy his or her personal data.
5) Requesting to disclose the acquisition of personal data in the case where such data were
processed without consent.
In the event that the company collects, uses and discloses personal data for the purpose of
performing contract with data subject or for legitimate interests of the company or for the performanceof legal duties of the company, the company shall be entitled to object or refuse the aforementioned
rights of data subject 3) and 4)
10.4 The company shall be entitled to object or refuse the aforementioned rights of supplier asdata subject under the condition of PDPA or the exercise of such rights are contrary to or inconsistent
with the provisions of the law or affecting the rights and liberties of other people or in the case of
personal data of the data subject has been made anonymous or can no longer identify the data
subject.

Page 19/21
Tasith (Assembly) Factory
WHA Eastern Seaboard Industrial Estate 1, 500/5 M. 3, T. Tasith, A. Pluakdaeng, Rayong 21140 Tel. +66 (0) 3895 0040-4 Fax +66 (0) 3895 0045-6

Pluakdaeng (Fabrication) Factory
Eastern Seaboard Industrial Estate 29 M. 4, T. Pluakdaeng, A. Pluakdaeng, Rayong 21140 Tel. +66 (0) 3895 4790-4 Fax +66 (0) 3895 4795

Bangkok Office4345 Bhiraj Tower at BITEC, Room 1503-1505, 15th Floor, Sukhumvit Road, Bangna Tai, Bangna, Bangkok 10260 Tel. +66 (0) 2399 5900-4 Fax +66 (0) 2399
5905

Philippines Branch
Unit 1501, 15th Floor, Wilcon IT HUB 2151 Chino Roces AVE., Bangkal, Makati City, Philippines 1233 Tel. +63 2 8820 7394 Fax +63 2 8816 1801

10.5 In case where the company process personal data of supplier on the basis of consent,such as section 4.6, 4.7, 4.8, the data subject has the right to withdraw his or her consent. However,such withdrawal may affect benefits of data subject that the company has provided in addition to theemployment contract. In addition, the withdrawal may affect the benefits from contract or relevant
agreements as well as an opportunity for further contract or other legal act, depending on the nature of
the contract on a case-by-case basis.
11 Review of policies, sub-policies, regulations and guidelines.
The company may establish guidelines for the protection of personal data of supplier,specifying the details of the personal data protection policy as well as may prescribe additional rules
and practices to be in compliance with the PDPA announcement and or as amended in the future andother relevant laws.
12. Processing of Special category of personal data or “Sensitive personal data”
12.1 In principle, the company shall not process “Special category of personal data” or“Sensitive personal data” of supplier such as political cult religion or philosophy sexual behavior,criminal records, health information, disability, Labour Union status, genetic data, biological data or
any other data defined by PDPA without consent of data subject evidence in the form attached to thispolicy except where the law provided.
12.2 The company shall process sensitive personal data of supplier which is part of orcontained in identity card such as religion or blood types, for the purposes notified in section 4.1
and/or 4.2, for the process of negotiation, contract negotiation or performance of contract based on
express consent of data subject in the form attached to this policy unless provided by the law.

Page 20/21
Tasith (Assembly) Factory
WHA Eastern Seaboard Industrial Estate 1, 500/5 M. 3, T. Tasith, A. Pluakdaeng, Rayong 21140 Tel. +66 (0) 3895 0040-4 Fax +66 (0) 3895 0045-6

Pluakdaeng (Fabrication) Factory
Eastern Seaboard Industrial Estate 29 M. 4, T. Pluakdaeng, A. Pluakdaeng, Rayong 21140 Tel. +66 (0) 3895 4790-4 Fax +66 (0) 3895 4795

Bangkok Office4345 Bhiraj Tower at BITEC, Room 1503-1505, 15th Floor, Sukhumvit Road, Bangna Tai, Bangna, Bangkok 10260 Tel. +66 (0) 2399 5900-4 Fax +66 (0) 2399
5905

Philippines Branch
Unit 1501, 15th Floor, Wilcon IT HUB 2151 Chino Roces AVE., Bangkal, Makati City, Philippines 1233 Tel. +63 2 8820 7394 Fax +63 2 8816 1801

12.3 The company shall process sensitive personal data of supplier which is part of orcontained in identity card such as religion or blood types, for the purposes notified in section 4.4 incase of security measures for entering in and out of the company, life or safety measures, with express
consent of data subject in the form attached to this policy.
12.4 The company shall process sensitive personal data of supplier which is part of orcontained in identity card such as religion or blood types, for the purposes notified in section 4.3, incase the company has legal obligation to process without consent of data subject as provided by
PDPA
12.5 In case the company collects, uses, discloses sensitive personal data of employee,
agent, representatives, designated or assigned person of supplier, the company has notified thedetails in section 6.4-6.6 and 8.3
13. Channel to contact Personal Data Controller
The supplier as a data subject could contact the company for the purpose of exercising data
subject’s right and for other purposes relating to PDPA at Corporate Planning Section / Tel. +66 (0)3895 0040-4 ext. 404
14. Acknowledgment of the Policy
I have read and fully understood this Policy that the company has notified therefore signed for
acknowledgment.
Signed __________________________________________(_________________________________________)

Date.......................................................

Page 21/21
Tasith (Assembly) Factory
WHA Eastern Seaboard Industrial Estate 1, 500/5 M. 3, T. Tasith, A. Pluakdaeng, Rayong 21140 Tel. +66 (0) 3895 0040-4 Fax +66 (0) 3895 0045-6

Pluakdaeng (Fabrication) Factory
Eastern Seaboard Industrial Estate 29 M. 4, T. Pluakdaeng, A. Pluakdaeng, Rayong 21140 Tel. +66 (0) 3895 4790-4 Fax +66 (0) 3895 4795

Bangkok Office4345 Bhiraj Tower at BITEC, Room 1503-1505, 15th Floor, Sukhumvit Road, Bangna Tai, Bangna, Bangkok 10260 Tel. +66 (0) 2399 5900-4 Fax +66 (0) 2399
5905

Philippines Branch
Unit 1501, 15th Floor, Wilcon IT HUB 2151 Chino Roces AVE., Bangkal, Makati City, Philippines 1233 Tel. +63 2 8820 7394 Fax +63 2 8816 1801